Hi, I think I've figured this out, I'd just like some backup or affirmation here. (And yes, I did a search, just didn't find anything. That may have been because I didn't know the key words to look for). My /var/log/secure file has been showing ssh sessions at various times of the day, that in itself isn't that disconcerting since we've got more than 1 person that has to access it. The part that was kind of worrying was the fact that the port it was using was different each time. I think what is happening is that SSH is just either forwarding or using a different port for each connection. Is that the case? In testing that theory, I watched the log file (tail -f /var/log/secure) and proceeeded to log in via ssh 3 different times. The ports it used were 62274, 62275, 62276.

If anyone can affirm this as normal, that'd be great!

Hi.

Does the log look like:?

If so, it's normal. The port referred to (1911 in this case) is the remote side's port, which will be random, and outside the privileged port range.

Dave

Yes, exactly! Thanks for affirming my theory.